Overview
overview
9Static
static
7release.rar
windows7-x64
3release.rar
windows10-2004-x64
3release/ma...at.exe
windows7-x64
9release/ma...at.exe
windows10-2004-x64
9release/ma...er.exe
windows7-x64
9release/ma...er.exe
windows10-2004-x64
9release/readme.txt
windows7-x64
1release/readme.txt
windows10-2004-x64
1Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 08:19
Behavioral task
behavioral1
Sample
release.rar
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
release.rar
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
release/main/cheat.exe
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
release/main/cheat.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
release/main/loader.exe
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
release/main/loader.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
release/readme.txt
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
release/readme.txt
Resource
win10v2004-20240508-en
General
-
Target
release/main/cheat.exe
-
Size
4.1MB
-
MD5
d1895f02df8810e698741d4805317916
-
SHA1
b45eb5ebe4184b6249f514122838b582c8030a0b
-
SHA256
b2304109f2212ccf8b49c9fe8999b178ce7563c1c7540a05ea3d2836b22d361d
-
SHA512
bf9449415ee28b84319df57dca23ce43b345e5dfa042e2613fd84f183a02154bca859785a8b51434ed5466ea7def19a2d562822d9d9f1c7a9de72055843d60b1
-
SSDEEP
98304:bSXAizswlu7vCx/0nrEw1PP3rSDdV+8Tz7kI:bS/Qa50RP3rSP3II
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
cheat.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ cheat.exe -
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
cheat.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\frAQBc8Wsa1xVPfv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\frAQBc8Wsa1xVPfv" cheat.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
cheat.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cheat.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion cheat.exe -
Processes:
resource yara_rule behavioral3/memory/1956-0-0x000000013FCB0000-0x000000014075F000-memory.dmp themida behavioral3/memory/1956-2-0x000000013FCB0000-0x000000014075F000-memory.dmp themida behavioral3/memory/1956-3-0x000000013FCB0000-0x000000014075F000-memory.dmp themida behavioral3/memory/1956-4-0x000000013FCB0000-0x000000014075F000-memory.dmp themida behavioral3/memory/1956-7-0x000000013FCB0000-0x000000014075F000-memory.dmp themida behavioral3/memory/1956-6-0x000000013FCB0000-0x000000014075F000-memory.dmp themida behavioral3/memory/1956-5-0x000000013FCB0000-0x000000014075F000-memory.dmp themida behavioral3/memory/1956-8-0x000000013FCB0000-0x000000014075F000-memory.dmp themida behavioral3/memory/1956-24-0x000000013FCB0000-0x000000014075F000-memory.dmp themida behavioral3/memory/1956-25-0x000000013FCB0000-0x000000014075F000-memory.dmp themida -
Processes:
cheat.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cheat.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
cheat.exepid process 1956 cheat.exe -
Processes:
cheat.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 cheat.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde cheat.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
cheat.exepid process 1956 cheat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cheat.exedescription pid process Token: SeLoadDriverPrivilege 1956 cheat.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
cheat.execmd.exedescription pid process target process PID 1956 wrote to memory of 2520 1956 cheat.exe cmd.exe PID 1956 wrote to memory of 2520 1956 cheat.exe cmd.exe PID 1956 wrote to memory of 2520 1956 cheat.exe cmd.exe PID 2520 wrote to memory of 2628 2520 cmd.exe certutil.exe PID 2520 wrote to memory of 2628 2520 cmd.exe certutil.exe PID 2520 wrote to memory of 2628 2520 cmd.exe certutil.exe PID 2520 wrote to memory of 2764 2520 cmd.exe find.exe PID 2520 wrote to memory of 2764 2520 cmd.exe find.exe PID 2520 wrote to memory of 2764 2520 cmd.exe find.exe PID 2520 wrote to memory of 2768 2520 cmd.exe find.exe PID 2520 wrote to memory of 2768 2520 cmd.exe find.exe PID 2520 wrote to memory of 2768 2520 cmd.exe find.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe"C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Sets service image path in registry
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c certutil -hashfile "C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe" MD5 | find /i /v "md5" | find /i /v "certutil"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\certutil.execertutil -hashfile "C:\Users\Admin\AppData\Local\Temp\release\main\cheat.exe" MD53⤵
-
C:\Windows\system32\find.exefind /i /v "md5"3⤵
-
C:\Windows\system32\find.exefind /i /v "certutil"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Virtualization/Sandbox Evasion
1Modify Registry
2Subvert Trust Controls
1Install Root Certificate
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1956-0-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB
-
memory/1956-1-0x0000000077920000-0x0000000077922000-memory.dmpFilesize
8KB
-
memory/1956-2-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB
-
memory/1956-3-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB
-
memory/1956-4-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB
-
memory/1956-7-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB
-
memory/1956-6-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB
-
memory/1956-5-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB
-
memory/1956-8-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB
-
memory/1956-24-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB
-
memory/1956-25-0x000000013FCB0000-0x000000014075F000-memory.dmpFilesize
10.7MB